MyTube contains an improper access control flaw that permits an attacker with low‑privilege authentication to upload and replace the entire SQLite database via the /api/settings/import-database endpoint. By doing so, the attacker can modify or delete all stored data, effectively gaining complete control over the application. The weakness manifests as improper authorization and privilege escalation, allowing the attacker to bypass intended restrictions and execute arbitrary operations against the application’s data layer.

The vulnerability affects the MyTube self‑hosted downloader and player. All releases prior to version 1.8.69 are affected by the authorization bypass. Version 1.8.69 and later contain the fix that removes the privilege escalation path.

The CVSS score of 7.4 indicates a high severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The attacker requires only authenticated, low‑privilege access and the ability to send a POST request to the vulnerable endpoint; no special conditions beyond that are described.